An automated threat intelligence aggregator providing a central hub for supply chain attacks and actively exploited vulnerabilities.
SIEM Ingestion Feed docsCISA added CVE-2023-4346 affecting KNX Protocol Connection Authorization Option 1 to the Known Exploited Vulnerabilities catalog on 2026-07-15. This post scopes exposure, affected/fixed evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-46817 affecting Oracle E-Business Suite / Oracle Payments File Transmission to the Known Exploited Vulnerabilities catalog on 2026-07-15. This post scopes exposure, affected/fixed evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-56155 affecting Microsoft Active Directory Federation Services (AD FS) to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-56164 affecting Microsoft SharePoint Server to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2008-4128 to KEV on 2026-07-13. The issue affects Cisco IOS 12.4 HTTP Administration on Cisco 871 ISR devices, where cross-site requests can reach level-15 command URIs.
Lucide Proxy abused 148 npm packages as static delivery artifacts for proxy pages; historical builds remotely loaded code and conscripted visiting browsers into Wisp and HTTP floods, while the latest documented wave was adware-only.
Five interleaved malicious jscrambler releases executed a bundled native infostealer on developer and CI hosts.
CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment.
CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment.
A fake Braintree-compatible NuGet package used production-only payment hooks and a companion module initializer to steal card and host secrets.
A compromised maintainer account pushed wallet-key exfiltration code through Injective’s trusted GitHub Actions publisher into 18 npm packages.
A deceptive Go module exposed a Windows malware-staging chain and a high-confidence GitHub lure network of 222 repositories across 190 accounts.
CISA added CVE-2026-48282 affecting Adobe ColdFusion to the Known Exploited Vulnerabilities catalog on 2026-07-07. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-56290 affecting Joomlack Page Builder to the Known Exploited Vulnerabilities catalog on 2026-07-07. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.
CISA added CVE-2026-48908 affecting JoomShaper SP Page Builder to the Known Exploited Vulnerabilities catalog on 2026-07-07. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
CISA added CVE-2026-55255 affecting Langflow Langflow to the Known Exploited Vulnerabilities catalog on 2026-07-07. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.
Seventeen coordinated payment-brand typosquats across npm and PyPI impersonated SDKs and exfiltrated environment secrets to an ngrok host.
Defender-focused assessment of SysAid software update deployment feature.
CISA added CVE-2026-45659 affecting Microsoft SharePoint Server to the Known Exploited Vulnerabilities catalog on 2026-07-01. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CISA added it to KEV on 2026-07-01, making it an in-scope exploited-vulnerability coverage item.
Socket reports 162 malicious release artifacts across 108 packages and extensions, with hidden JavaScript loaders targeting developer environments across four ecosystems.
CISA added CVE-2026-48558 affecting SimpleHelp SimpleHelp to the Known Exploited Vulnerabilities catalog on 2026-06-29. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.